Port Bugzilla appliance to TurnKey 19 - #20

The inherited Bugzilla vhost uses SSLEngine, but the appliance did not enable mod_ssl. Normal firstboot reached runtime with an invalid Apache configuration, so enable the module alongside the other required vhost modules.

Verified by the first exact Trixie run reaching runtime tests and failing specifically at apache2ctl -t on the missing SSLEngine command.

The final appliance root owns the deployed checkout, so invoking Git as www-data triggers Git safe-directory rejection before any application assertion. Exercise the documented root-run supervised update workflow with the actual deployment ownership instead.

The preceding exact run proved normal firstboot and valid Apache SSL configuration before failing at the mismatched test identity.

The deployed checkout has mixed build and service ownership, so neither changing to www-data nor running plain Git as root reliably passes Git ownership protection. This blocked the documented supervised updater before any application assertion.

Pass a per-command safe.directory for only /var/www/bugzilla in the root-run test and documented update workflow. This avoids a global trust exception while preserving the maintained upstream 5.2 update path.

The acceptance expression lost its dollar-sign escape during shell parsing, so grep interpreted the anchor as the end of the line and rejected the valid generated localconfig before application tests ran.

Use a bracket expression for the literal dollar sign. Fixture checks cover both the expected MariaDB setting and a mismatched driver; this is a test-only correction and does not consume a product fix loop.

Bugzilla's manual Apache overlay enabled mod_ssl without TurnKey's certificate configuration, so Apache failed during normal firstboot and HTTPS never listened. Use the existing LAMP make fragment to apply the standard Apache TLS, headers, security, MariaDB, PHP, and Adminer contracts while retaining the Bugzilla credit hook.

Verified with the resolved FAB make variables, shell syntax checks, and git diff --check. The exact d90b7ef run supplied the firstboot failure evidence.

Bugzilla 5.2 leaves the default operating system and platform empty while treating both fields as mandatory during bug creation. Make the acceptance request portable by sending the documented defaulted fields explicitly, including priority and severity, so the test reaches the appliance's ordinary CRUD behavior.

Verified the payload as JSON, checked the test with bash -n, and ran git diff --check. This is a test-only correction from the exact 0a02d83 runtime result.

Bugzilla 5.2 initializes named priority values rather than the legacy P1 through P5 scale. Send the installed default priority in the focused REST creation request so the acceptance test exercises ordinary bug creation instead of correctly receiving a not-found response for an unknown field value.

Verified the payload as JSON, checked the test with bash -n, and ran git diff --check. This is a test-only correction from the exact 2ddf72c runtime result and does not consume a product fix loop.